# Internal Audit Report

## Accounts Receivable (Invoice Processing) Audit 2019/20

| To: | Director of Finance | |-----|---------------------| | | Deputy Director of Finance | | | Head of Finance (Exchequer) | | **Copied to:** | Assistant Finance Manager (AR) | | **Council Management Team (CMT)** | Operations Director, Re | | | Operations Director, CSG | | | Education & Skills Director, Cambridge Education | | | Head of Property Services & Valuation, CSG | | | Street Scene Commercial Manager | | | Group Manager, Licensing, Re | | | Head of Performance and Risk, CSG and Re | | | Finance Manager, Cambridge Education | | | Education Welfare Manager, Cambridge Education | | | Document Centre and Mailroom Manager, CSG | | | Finance Manager- Family Services | | | Head of Service, Hospitals and Health Partnerships – Adults & Communities | | | Manager Community Financial Assessment Team | | **From:** | Internal Audit Executive, LBB | | | Head of Internal Audit LBB |

We would like to thank management and staff of the Accounts Receivable team and other teams in the Council / its partners for their time and co-operation during the course of the internal audit. Executive Summary

| Assurance level | Number of recommendations by risk category | |-----------------|------------------------------------------| | Limited Assurance | Critical | High | Medium | Low | Advisory | | | - | 1 | 6 | 1 | - |

Scope

The Council issues invoices to its customers and clients to collect income for services provided for them. Invoice processing reviews will allow the income of the council to flow in without hindrances as the invoices are produced accurately and on a timely basis. The invoices should be issued at whatever intervals are agreed in the service agreement.

The audit covered arrangements within the Council’s central finance team as well as reviewing a sample of invoicing teams across the Council and three of its contracted partners (CSG, Re and Cambridge Education).

Summary of findings

This audit has identified 1 high, 6 medium and 1 low risk finding.

We identified the following issues as part of the audit:

- **Income Collection manual invoicing (Spreadsheet) Process (high)**: We found within our sample that controls on manually produced invoices (through spreadsheet) are not adequate. The invoices are not checked or authorised by senior officers.
- **Income Collection and Debt Management Guidance (ICDMG) (medium)**: During fieldwork, we noted that most invoicing teams (6/8 (75%) that we tested) are not aware of the ICDMG. We identified that the ICDMG was not version controlled, the date of production, the producer and next review date were not included on the document.
- **Commercial Rents – CSG Estates (medium)**: During fieldwork, we identified 8 expired leases/rent contracts (40%) which had not been renewed. The contract renewal process is slow; we identified that 8 cases (40%) the renewal took between 5 months to 5 years.
- **Commercial Waste – Street Scene (medium)**: Waste contract management controls are not operating effectively; we identified 12 cases (48%) where Business Recycling & Waste Agreement Forms were not counter-signed by LBB.
- **Premises Licensing and Gambling (PLG) - Re (medium)**: In the process of the audit we established that 8/15 credits notes issued (53%) were issued to previous holders of licenses who were no longer in control of the premises and had not informed PLG of their change of circumstances, 5/15 (33.3%) were issued to suspended customers; while 2/15 (13%) credit notes were issued to correct duplicated invoices. Additionally, we found that 12 invoices that were supposed to be cancelled in 2017 were still outstanding in Integra as at October 2019. It is also noted that all the AR requests for approval to take recovery action had not been granted. Lastly, we found that the council’s debt write-off process was not followed by the team. • **Education Accounts – Cambridge Education (medium):** We found three cases (30%) which had no source document for invoices issued. We noted 10 cases (100%) where the old location of the team was on the invoices instead of the new location. We identified that in 100% of the debt write-off process tested, the LBB process was not followed.

• **Document Centre and Mailroom - CSG (medium):** There is no evidence of adequate separation of duties in the printing process, we identified that whereas there is a good, separate first level security control of ID and password for members of staff printing the invoices, the second level of security is not adequate as the two members of staff use the same code to print.

• **Overpayments – Family Services (low):** We noted that the overpayments bad debts were due to delay in accessing the necessary information required to enable the team to confirm outstanding invoices and chase them before they become doubtful or bad.

We followed up to confirm that the actions agreed as part of the 2018/19 Debt Management audit had been completed. The AR2 concerning “Age debt monitoring” has been implemented while AR3 regarding “Third party debt collections” is not yet fully implemented, although reasonable progress has been made (See appendix 4).

## 2. Findings, Recommendations and Action Plan

| Ref | Finding | Risks | Risk category | Agreed action | |-----|---------|-------|---------------|---------------| | 1 | **Invoices Procedure** - Invoices produced on Spreadsheet | If invoices and credit notes are not independently reviewed and approved **then** there is a risk of error or fraud. If invoicing teams are not aware of the procedures in place **then**, there is a risk that inconsistent practices may occur and go undetected. | High | a) All manually loaded spreadsheets must include documented approval by an appropriate authorised person to evidence that the spreadsheet has been independently checked for accuracy, in line with the Financial Regulations requirement that separation of duties must be in place for all financial transactions. |

**Responsible officers:**

a) All invoicing teams across the Council and its partners.

**Target date:**

31 January 2020

______________________________________________________________________

A sample of eight invoicing teams were selected for testing across the Council and three of its contracted partners: CSG, Re and Cambridge Education.

The review established that Council’s invoices are produced in two main ways: manual and electronic. The electronic method is produced, checked and authorised on the Integra system, while the manual method involves production of invoices using spreadsheets. The spreadsheets are then sent to the Integra team for upload into the system. The testing confirmed that adequate controls authorisation is in place for the electronic invoice production method through Integra; invoices are checked and authorised by appropriate officers.

However, manually loaded spreadsheets (invoices) in the service areas reviewed established that those service areas do not comply with section 3.1.2 of the Financial Regulations which state: “There must be adequate separation of duties to ensure that no one officer is able to handle any financial transaction from start to finish without there being some mechanism for independent checking. By finish is meant the completion of the accounting for the transaction”.

The testing established that:

- There is not adequate segregation of duties in the manual invoicing process in the two service areas we reviewed that had used this method. One member of staff starts the process from beginning to the end.
- The spreadsheets are produced and forwarded to the Integra team for upload by the same officer without any authorisation or approval by a senior officer.
- There is no evidence that the spreadsheets were checked and signed by a senior officer or a manager. Unlike for teams invoicing via Integra, for manual spreadsheets there is no control on the Integra system to ensure that a senior officer approves the content of the spreadsheet on the system (see table below showing the invoicing teams sampled).

| Invoicing Teams Tested | Team Using Integra | Team Using Spreadsheet | Team Using Integra and Spreadsheet | |------------------------|--------------------|------------------------|-----------------------------------| | Property Services & Valuation (CSG): Commercial Rents | Public Protection (Re): Licensing and Gambling | Adult Social Care: Social Care and Ad-hoc | | Note: this team had not invoiced via spreadsheet during the period under review | | Street Scene Commercial Services: Commercial Waste | Education Partnership & Commercial Services (Cambridge Education): Education Account. | | Adult & Health: Actual Billing (Community) | | Early Intervention & Prevention (Family Services): Overpayments | | Adult & Health: Residential Care Homes | | 5 | 2 | 1 | | Ref | Finding | Risks | Risk category | Agreed action | |-----|---------|-------|---------------|---------------| | 2. | **Invoicing Procedure** - Income Collection and Debt Management Guidance (ICDMG) | If invoicing teams are not aware of the procedures in place then, there is a risk that inconsistent practices may occur and go undetected. | Medium | (a) Finance will ensure that all invoicing teams are aware of and understand procedures as set out in the Income Collection and Debt Management Guidance (ICDMG). This may require a training session or a notification each time the guidance is updated. | | | There is an Income Collection and Debt Management Guidance (ICDMG) document in place. | If process and procedure documents used by the Council are not version controlled then inconsistent practices may occur and go undetected as various versions of the documents may be in circulation. | | (b) Finance will ensure that a procedure note is produced and publish on the intranet. | | | A sample of eight invoicing teams were selected for testing and our discussion with each team established that six teams (75%) are unaware of the guidance note. Our testing found examples of the guidance not being followed, e.g. with regards to Write Offs (see findings 4 and 5 below). | | | (c) Finance will ensure that the Income Collection and Debt Management Guidance (ICDMG) is version controlled to ensure teams can identify and are using the correct version. | | | The guidance is not version controlled as the date of production and next review dates were not indicated on the document. Although, the Assistant Finance Manager (AR) informed us that the guidance was reviewed last year, there is no evidence to confirm this as the document was not version controlled. | | | |

**Responsible officer:** Assistant Income Manager

**Target date:** 31 January 2020 2. **Commercial Rents – CSG Estates**

The Commercial rents invoicing process was tested to ensure that the process and procedure comply with the Council’s Income Collection and Debt Management Guidance.

20 invoices were randomly selected from year 2019/20 commercial rent list (portfolio) for our testing. The testing established that:

- Contracts for eight out of 20 (40%) invoices selected are expired and are yet to be renewed. Effectively, the fees/charges have not been agreed and signed up to by the lessor.
- The leases and rents renewal process is very slow. Our testing confirmed that for eight out of 20 (40%) rents/leases reviewed, it took an average of between 5 months to 5 years for renewal. During the process of renewal, tenants were not invoiced leading to loss of income to the Council. The table below shows the analysis of delays detected in the tenancy and rents/leases renewal process.

| Customer Number | Expiry Date | Number of Years | |-----------------|-------------|-----------------| | 10043960 | 12/02/2014 | 5 years | | 10004859 | 30/06/2014 | 4 years + | | 10019650 | 15/03/2015 | 4 years | | 10004620 | 25/10/2016 | 3 years + | | 10060430 | 1/10/2017 | 2 years + | | 10026742 | 24/12/2017 | 1.5 years | | 10026754 | 25/12/2018 | 1 year | | 10029515 | 30/06/2019 | 4 months |

If lease/rents contracts renewal process is unnecessarily delayed then the council could lose income, potentially leading to budget pressures and cash flow problems.

**Agreed action**

- **Medium**
  - a) The Commercial Rents team will ensure that expired leases and rents are renewed promptly to improve the income and cash flow of the Council.
  - b) The lease and rent renewal process will be reviewed for efficiency and effectiveness and changes implemented where necessary.

**Responsible officer:**

Head of Property Services & Valuation

Property Services Officer

**Target date:** 31st March 2020 | Ref | Finding | Risks | Risk category | Agreed action | |-----|---------|-------|---------------|---------------| | 3. | **Commercial Waste – Street Scene**<br>Our testing of the commercial waste invoicing process revealed that records of transactions are maintained. However, the records are not complete and show evidence of lack of administrative/internal controls.<br>A sample of 25 invoices were obtained for testing and we established that:<br>In 12/25 (48%) of the invoices tested, the “Business Recycling & Waste Agreement Form” (BRWA Form) were signed by the clients but not signed by LBB staff to show evidence of administrative and internal control;<br>In one case (4%), the BRWA Form was not signed by either of the two parties (i.e. representative of the Council and the client), which invalidates the contract; and | If contracts or agreements between the council and its clients are not adequately documented and signed then there is a risk that charges for the Council’s services to such clients might unenforceable, leading to the council losing income, or lead to disputes should there be a misunderstanding or reason for litigation. | Medium | a) The Commercial Waste team will ensure there are controls in place to certify that all waste contracts are reviewed for accuracy and correctness by making sure that all BRWA Form are countersigned by LBB staff and that signed copies of the form are retained appropriately.<br>**Responsible officer:**<br>Street Scene Commercial Manager - Finance& Performance Manager (Commercial Development Team) - S<br>**Target date:** 31<sup>st</sup> March 2020 | | 4. | **Premises Licensing and Gambling (PLG) - Re**<br>A sample of 15 credit notes were obtained for testing and we established that 15/15 (100%) were issued to clients who were no longer in control of the premises and did not inform PLG of their change of circumstances.<br>We noted that:<br>• 8/15 were issued to previous holder of licenses who were no longer in control of the premises and did not inform PLG of their change of circumstances | If necessary and timely information is not available to the right team at the right time then, there is a risk of delay in acting against | Medium | a) The Premises Licensing and Gambling team will review its processes in relation to termination and transfer of licences to ensure terminated clients are removed from the database for invoicing immediately. Team to also review last 12 months to ensure these have been actioned. | | Ref | Finding | Risks | Risk category | Agreed action | |-----|---------|-------|---------------|---------------| | | • 5/15 were issued to suspended customers\
• 2/15 were issued to correct duplicated invoices (and this is an avoidable error) | debtors leading to loss of income or cash flow problems. | | b) The PLG team will cancel all outstanding items coded 49 in the system to ensure that the balances available in the account are accurate and correct. | | | Furthermore, our review found that all the 12 invoices coded 49 by Team Leader (Licensing & Anti-Social Behaviour) on Integra on 8th August and 12th September 2017 are still outstanding as at end of November 2019. Items coded 49 are supposed to be cancelled immediately but in this case the items were delayed without any reason. | If credit notes are delayed then, there is a risk that the account balances might be misleading resulting in overstated income which would be reported by the council’s external auditor. | | c) The PLG team will raise a call with CST for any further bespoke reports that are required from Integra. | | | **Debt Recovery** | | | d) Henceforth, the Premises Licensing and Gambling team will be routinely providing authorisation for the AR team to take recovery action against unpaid invoices when the premises ceased trading. | | | The Premises Licensing and Gambling team stated they have no access to run the report that will enable them to obtain the necessary information required to act promptly against a licensing payments defaulter. The AR team provided evidence of the reports that they provide the PGR team with (‘PRL DEBT’ report and ‘PRL debts MH’). | | | e) The Premises Licensing and Gambling team will explore the possibility of setting up direct debits for all its clients/customers to improve the council’s income. | | | Our discussion with the Team Leader (Licensing & Anti-Social Behaviour) confirmed their view that the reports received are not sufficient and the team is not configured to produce reports on Integra to enable it to effectively monitor its clients. | | | f) The AR team will provide a direct debit form with the correct address. | | | Additionally, we noted that permission to take recovery action made by the AR for unpaid invoices where premises has ceased trading were not authorised by the Premises Licensing and Gambling Team (as the PLG team claimed they were unaware that authorisation is required) making it impossible for AR to pass the bad debt over for debt recovery and collection action. | | | g) The Premises Licensing and Gambling team bad debts will be processed for approval in accordance with the Council’s Financial Regulations. The team | | | **Direct Debits** | | | | | Ref | Finding | Risks | Risk category | Agreed action | |-----|---------|-------|---------------|---------------| | | address (it carries the North London Business Park address instead of the team’s Colindale address). **Write-Off** Our review established that Premises Licensing and Gambling team wrote off bad debts annually with approval from the Commercial Premises Manager only. They were unaware of any other need for approval, as required by the Council’s Financial Regulations. The team stated that the Commercial Premises Manager meets periodically with the AR team who had not provided any other process for the team to follow. However, the Financial Regulations form part of the Council’s constitution which partners are required to comply with. The review confirmed that credit notes were raised to cancel outstanding invoices (effectively write-off bad debts). This method by-passes the process and controls put in place by management. **Note:** Please also refer to Finding 1, Invoices Procedure - Invoices produced on Spreadsheet and its associated action which should be taken forward by the PLG team: *All manually loaded spreadsheets must include documented approval by an appropriate authorised person to evidence that the spreadsheet has been independently checked for accuracy, in line with the Financial Regulations requirement that separation of duties must be in place for all financial transactions.* | will verify the required approval limits and comply with these. **Responsible officer:** Group Manager: (except action (f), see below) **Target date:** 31st March 2020 (f) Assistant Income Manager **Target date:** Complete | | 5 | **Education Welfare Accounts – Cambridge Education** Ten invoices were randomly selected for our testing from the education penalty charges issued in the current financial year by the Education team. The invoices were issued to parents/guardians for unauthorised absenteeism from school. The testing established that: | If there are no source documents for invoices issued then there is a risk that invoice disputes will be | Medium | a) The Education Team will ensure that the address on the invoices is changed to its current location from NLBP in accordance with the London Borough of Barnet Income Collection and Debt Management Guidance. | | Ref | Finding | Risks | Risk category | Agreed action | |-----|---------|-------|---------------|---------------| | | • Three out of ten had no source document. Discussion with the officer indicated that the documents might have been shredded by the Education Welfare Manager.\
• All the ten invoices tested had the team’s old address of North London Business Park, Oakleigh Road South, N11 1NP whereas the team is currently located in Colindale. This is contrary to the information on page 5 of the London Borough of Barnet Income Collection and Debt Management Guidance which states “All invoices will be raised within 2 days of service delivery……, and will include clear, relevant and full information as to: how to contact the Council if there is a query in relation to the invoice or in relation to making payment”. | difficult to resolve and inconsistent practices might be going undetected in the system. | b) The Education team will ask schools to scan their documents/forms to the team and the scanned copies will be kept electronically until the end of the financial year when bad debts will be written off and forms erased. | | | Write-Off | If credits, bad debts and doubtful debts are processed without approval in accordance with the financial regulation provisions then there is a risk of | c) Going forward, Education Account Team’s credits, bad debts and doubtful debts will be processed for approval in accordance with the Council’s Financial Regulations (Fin Reg). The Team will verify the approval limits and comply with the provision of the Fin Reg. If an exception to the Fin Reg is required, this will be documented and approved by senior management and the Director of Finance. | | | Our testing established that the Education Accounts team wrote off debts annually with the authorisation of the Education Welfare Team Manager only. The review confirmed that credit notes for a total sum of £41,400 were raised to cancel outstanding invoices and debts at the end of the last financial year without the list of write-offs subsequently being signed off formally by the head of service. A proportion of this debt related to credits raised for prompt payment by parents within 21 days as stated under the terms of the invoice. Both these prompt payment credits and other bad debt write offs require management approval. | | | | | Note: Please also refer to Finding 1, Invoices Procedure - Invoices produced on Spreadsheet and its associated action which should be taken forward by the Education team:\
All manually loaded spreadsheets must include documented approval by an appropriate authorised person to evidence that the spreadsheet has been independently checked for accuracy, in line with the Financial Regulations requirement that separation of duties must be in place for all financial transactions. | | | | | Responsible officer:\
Finance Manager\
Education Welfare Manager\
Target date: 31st March 2020 | | | | Ref | Finding | Risks | Risk category | Agreed action | |-----|---------|-------|---------------|---------------| | 6 | **Document Centre and Mailroom - CSG**<br>Our review/observation of the invoice production, compilation and postage process by the Document Centre & Mail team established that there are two levels of security to enable the two members of staff involved to print the invoices. The first level consists of ID and password and the second level is an access code. These two levels of security are supposed to be independent and distinct to ensure effective control and an efficient audit trail so that it is clear who printed the invoices. Our testing established that:<br>• The first level of security for the two members of staff is satisfactory, each of them have distinct IDs and passwords; however:<br>• the second level of security/control is unsatisfactory as the two staff members share one code instead of having distinct access.<br>It is therefore not currently possible to confirm who has printed which invoices.<br>The Document Centre and Mailroom Manager informed us that the CST-Helpdesk and Assistant Finance Manager (AR) have been informed of the problem but are yet to update the process. | misappropriation and fraud. | Medium | a) The Document centre and mailroom team will liaise with the CST-Helpdesk to ensure that the second level of printing security is separated between the two Document Centre & Mail team staff members responsible for printing.<br>**Responsible officer:**<br>Document Centre and Mailroom Manager<br>**Target date:** 31st March 2020 | | 7 | **Family Services Finance Team (Overpayments)**<br>The testing of the invoicing process by the Family Services (FS) Finance Team (Overpayments) is satisfactory.<br>However, we observed that most of the bad debts that occurred in this area were due to a delay in accessing necessary information on the Integra finance system. The FS Finance Team is unable to produce aged debt reports from Integra to confirm outstanding invoices and chase these before they become doubtful or bad debts. | If necessary and adequate access is not given to the invoicing team to perform their roles and responsibilities then, there is a risk of inefficiency | Low | a) The Family Services Finance Team (Overpayments) will liaise with the AR team and CST to ensure they are given Integra access that will enable it to run aged debt reports. This will allow greater visibility of status of the debts and will enable the FS Finance Team to share information with the AR team where possible | | Ref | Finding | Risks | Risk category | Agreed action | |-----|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------|---------------|--------------------------------------------------------------------------------| | | The FS Finance Team (overpayment) currently receives information on non-paying clients after the debt has become doubtful or bad. Whilst it is not the responsibility of the FS Finance Team to chase debts, having access to an aged debt Integra report would give them visibility of the status of outstanding debts and would allow them to share information with the Accounts Receivable (AR) team where possible to reduce the risk of debts becoming bad. | and ineffectiveness leading to loss of income to the council. | | to reduce the risk of debts becoming bad. | | | | | | **Responsible officer:** Finance Manager (Family Services) | | | | | | **Target date:** 31st March 2020 | Appendix 1: Definition of risk categories and assurance levels in the Executive Summary

Note: the criteria should be treated as examples, not an exhaustive list. There may be other considerations based on context and auditor judgement.

| Risk rating | Immediate and significant action required. A finding that could cause: | |-------------|---------------------------------------------------------------------| | Critical | • Life threatening or multiple serious injuries or prolonged workplace stress. Severe impact on morale & service performance (e.g. mass strike actions); or | | | • Critical impact on the reputation or brand of the organisation which could threaten its future viability. Intense political and media scrutiny (i.e. front-page headlines, TV). | | | • Possible criminal or high profile civil action against the Council, members or officers; or | | | • Cessation of core activities, strategies not consistent with government’s agenda, trends show service is degraded. Failure of major projects, elected Members & Senior Directors are required to intervene; or | | | • Major financial loss, significant, material increase on project budget/cost. Statutory intervention triggered. Impact the whole Council. Critical breach in laws and regulations that could result in material fines or consequences. | | High | Action required promptly and to commence as soon as practicable where significant changes are necessary. A finding that could cause: | | | • Serious injuries or stressful experience requiring medical many workdays lost. Major impact on morale & performance of staff; or | | | • Significant impact on the reputation or brand of the organisation. Scrutiny required by external agencies, inspectorates, regulators etc. Unfavourable external media coverage. Noticeable impact on public opinion; or | | | • Significant disruption of core activities. Key targets missed, some services compromised. Management action required to overcome medium-term difficulties; or | | | • High financial loss, significant increase on project budget/cost. Service budgets exceeded. Significant breach in laws and regulations resulting in significant fines and consequences. | | Medium | A finding that could cause: | | | • Injuries or stress level requiring some medical treatment, potentially some workdays lost. Some impact on morale & performance of staff; or | | | • Moderate impact on the reputation or brand of the organisation. Scrutiny required by internal committees or internal audit to prevent escalation. Probable limited unfavourable media coverage; or | | | • Significant short-term disruption of non-core activities. Standing orders occasionally not complied with, or services do not fully meet needs. Service action will be required; or | | | • Medium financial loss, small increase on project budget/cost. Handled within the team. Moderate breach in laws and regulations resulting in fines and consequences. | | Low | A finding that could cause: | | | • Minor injuries or stress with no workdays lost or minimal medical treatment, no impact on staff morale; or | | | • Minor impact on the reputation of the organisation; or | | | • Minor errors in systems/operations or processes requiring action or minor delay without impact on overall schedule; or | | | • Handled within normal day to day routines; or | | | • Minimal financial loss, minimal effect on project budget/cost. |

| Level of assurance | | |--------------------|---------------------------------------------------------------------| | Substantial | There is a sound control environment with risks to key service objectives being reasonably managed. Any deficiencies identified are not cause for major concern. Recommendations will normally only be Advice and Best Practice. | | Reasonable | An adequate control framework is in place but there are weaknesses which may put some service objectives at risk. There are Medium priority recommendations indicating weaknesses but these do not undermine the system’s overall integrity. Any Critical recommendation will prevent this assessment, and any High recommendations would need to be mitigated by significant strengths elsewhere. | | Limited | There are a number of significant control weaknesses which could put the achievement of key service objectives at risk and result in error, fraud, loss or reputational damage. There are High recommendations indicating significant failings. Any Critical recommendations would need to be mitigated by significant strengths elsewhere. | | No | There are fundamental weaknesses in the control environment which jeopardise the achievement of key service objectives and could lead to significant risk of error, fraud, loss or reputational damage being suffered. | Appendix 2 – Analysis of findings

| Area | Critical | High | Medium | Low | Total | |-----------------------------|----------|------|--------|-----|-------| | | D | OE | D | OE | D | OE | D | OE | | | Process and procedure | - | - | 1 | - | 1 | - | - | - | 2 | | Invoicing process | - | - | - | - | 4 | - | 1 | | 5 | | Reconciliation process | - | - | - | - | - | - | - | - | | | Access data restriction | - | - | - | - | 1 | - | - | - | 1 | | Follow up | - | - | - | - | - | - | - | - | | | Total | - | - | 1 | - | 1 | 5 | - | 1 | 8 |

Key:

- Control Design Issue (D) – There is no control in place or the design of the control in place is not sufficient to mitigate the potential risks in this area.
- Operating Effectiveness Issue (OE) – Control design is adequate; however, the control is not operating as intended resulting in potential risks arising in this area.

Timetable

| Terms of reference agreed: | Fieldwork commenced: | Fieldwork completed: | Draft report issued: | Management comments received: | Final report issued: | |---------------------------|----------------------|----------------------|----------------------|-----------------------------|---------------------| | Date | Date | Date | Date | Date | Date | | 23rd September 2019 | 30th Sept 2019 | 14th November 2019 | 30th December 2019 | 2-14th January 2020 | 17th January 2020 |

## Appendix 3 – Identified controls

| Area | Objective | Risks | Identified Controls | |-----------------------|---------------------------------------------------------------------------|----------------------------------------------------------------------|-------------------------------------------------------------------------------------| | Process and Procedure | There are adequate invoicing processes and procedures in place and they operate effectively. Staff are aware of their role in the invoice production process, and perform their tasks appropriately. | If the current process is not documented and approved, there is a risk that inconsistent practices may go undetected and customers might not be invoiced. If the procedures and the process are not revised and updated regularly, there is a risk that the system may not include adequate separation of duties to reduce risk of fraud or collusion. If the process and procedures are not updated regularly, they may not enable staff to understand their tasks or to avoid overlapping tasks or confusion. | Documented invoice process procedure in place. Procedure available in electronic and hard copies. Procedure accessible to all members of staff involved in invoice processing. Procedure is reviewed and revised periodically. Roles responsibilities and separation of duties information is well documented. Next review date is documented on the procedure. | | Invoicing Process | There are adequate controls in place to ensure that the invoices are produced correctly, accurately and on time. Staff assigned to check arithmetical and other accuracies of invoices are aware of their responsibilities. | If there is no documented invoicing process in place, there is a risk that income will not be collected on a timely basis leading to cash flow problems. If the invoice production process is not monitored and checked regularly, the invoices might not be raised in | Documented and approved invoicing procedure is in place. Annual updates are carried out on electronic invoicing system. Test runs are carried out on the update to ensure that its accurate and such update should be signed off. There is segregation of duties in place and an individual officer cannot start and complete invoicing process. Senior member of staff is delegated to check the accuracy of the invoicing system and ensure that the content is correct. | | Reconciliation Process | The suspense and unidentified accounts are monitored regularly and income moved appropriately or in to the correct accounts. There is segregation of duties between staff reviewing the suspense and unidentified accounts and staff given approval for movement of income to the appropriate accounts/codes. Reconciliations are performed on a regular basis between Accounts Receivable (AR) and the General Ledger (GL) to ensure mistakes and errors are detected on a timely basis. | If suspense and unidentified accounts are not reconciled regularly, there is risk of loss of income, fraud or misappropriated funds. If suspense accounts are not regularly reconciled and monitored, the council might be unable to trace or identify payees of income; If income/payments are left in the suspense/unidentified accounts longer than necessary, there is a risk of having complaints from customers leading to bad publicity/image for the Council. If movements in and out of suspense/unidentified accounts are not monitored and approved, there is a risk of wrong accounts being | Suspense accounts containing unidentified income or payments are monitored and reconciled weekly. Payments in the suspense account should be investigated and funds transferred to its appropriate code. There is a limit to numbers of days funds/payments could stay in the suspense account. Age analysis of suspense accounts items are produced on a monthly basis to determine if none of the items are over required limit. There is process in place for movement of funds in and out of the suspense account. Approvals are required for funds to be moved out of the suspense account. Monthly or weekly reconciliation in place and are checked and authorised by senior officers. | Checks are in place to ensure that mistakes are detected before it goes out of the council. | | Access Data Restriction | There are controls in place to restrict access to data to prevent fraud and misappropriation of funds. There is sufficient audit trail in place to maintain and demonstrate review and approval of invoices prior to production. | If access to the invoicing system is not restricted and leavers are not deleted on a timely basis, there is a risk that the undeleted access could be used to perpetrate fraud. If access to the invoicing system is not restricted and is being access by leavers, there is risk that the invoice history/audit trails might be untraceable, removed or eliminated to cover frauds and misappropriation. If there is an insufficient audit trail to maintain and demonstrate review and approval of invoices prior to production, there is a risk of lack of accountability which could lead to reputational damage. | Access to the invoicing system is restricted by ID and password. There is process in place to report leavers promptly to ensure deactivation of ID and password Audit trail of activities conducted by individual on the system should be retrievable in case of fraud investigation. |

## Appendix 4

### Follow-up of previous audit recommendations

**2018-19 Accounts Receivable - Debt Management and Collection**

| Ref | Finding | Risks | Risk Category | Agreed action | |-----|---------|-------|---------------|---------------| | AR3 | **Third Party Debt Collections**<br>A sample of 25 instances of debts collected by third parties for the period 01/04/2018 – 31/10/2018 (per the Council’s accounts receivable listing) was reviewed. Our audit noted:<br>• 1 / 25 instances where the Council has not performed follow up procedures (or consulted with the Council’s legal team) to seek recovery of a debt since December 2017, when initial recovery attempts were made by the Council’s bailiff service at the time and the Council. The value of the debt was £1,641.<br>During the course of our testing we also noted that there was not a valid current contract in place between this bailiff and CSG Finance. | Debt collection agencies are not engaged in a timely manner, leading to debts which might have been recoverable becoming unrecoverable. | Medium | **Agreed Actions:**<br>1. Ensure that the lack of valid current contract with this bailiff is addressed and that the Council’s Contract Procedure Rules are adhered to.<br>2. Communicate and reinforce the requirements for third party debt collection, including where initial recovery attempts made by the bailiff and the Council are not successful, to ensure that follow up procedures are performed, or the debt is written off if required.<br><br>**Responsible Officer:**<br>Head of Finance (Exchequer) | **Internal Audit Assessment**<br>December 2019<br><br>**In Progress**<br>Reasonable progress has been made.<br>The responsible officer reported progress as follows:<br>Contract in place but not signed. High level consultation is expected to take place between Finance and Legal services to resolve some issues before final implementation. | | Ref | Finding | Risks | Risk Category | Agreed action | |-----|---------|-------|---------------|---------------| | AR2 | **Aged debt monitoring**<br>Our audit noted:<br>• A sample of service managers advised that the monthly aged debt report is high level only, and is insufficiently detailed for effective review of aged debt. As such, it is used for summary purposes only rather than detailed debt monitoring;<br>• Whilst departmental budget managers are expected to monitor and recover aged debt, there is no formal requirement for any actions to be taken by departmental budget managers upon receipt of the monthly aged debt report (i.e. to evidence that debt monitoring and appropriate follow up procedures have been completed); and<br>• The ‘Aged Debt Report’ at February 2019 showed the sum of aged debt older than one month was £18.3m, of which £3.6m was older than two years. | Where budget managers do not have sufficient details of aged debt and formal requirements for follow up and recovery procedures are not in place, there is an increased risk that staff may not have enough oversight of aged debt in their service area. Further, debt monitoring may not be carried out in a way that allows targeted collection of debt and early identification of issues with particular debtors, leading to financial loss for the Council. | Medium | **Agreed Actions:**<br>Management will:<br>1. Review the monthly aged debt reporting process. In conjunction with departmental budget managers, update and amend the format of the aged debt report to ensure that it is sufficiently detailed to allow service areas to conduct effective review and follow up of aged debt balances.<br>2. Develop and implement a process to ensure that departmental budget managers have completed debt monitoring and follow up procedures. This may include responding to the monthly aged debt report with details of follow up procedures undertaken and (where required),<br>The main service areas such as adults, property services, commercial waste, licencing, print room etc. receive a weekly/monthly report which details only their specific service area's debt. | **Internal Audit Assessment**<br>December 2019<br>**Implemented**<br>The response from the responsible officer and our review confirmed that:<br>In addition to a high level summary report being produced the details of all invoices are attached to the report. One can drill down to a specific invoice by clicking on each service area's debt. | | Ref | Finding | Risks | Risk Category | Agreed action | |-----|---------|-------|---------------|---------------| | | | | | actions to be taken to recover aged debt. | | | | | | 3. Review existing aged debt balances to establish whether further debt recovery processes can be carried out, or whether write off of debt is required (particularly for debt which is older than two years). | | | | | | **Responsible Officer:** Head of Finance (Exchequer) | | | | | | and status of invoices and debts. | | | | | | The Integra development team report has been improved and detail of the debt by cost centre is now available to assist each service area / budget manager to ensure effective monitoring of their debts. | Appendix 5– Internal Audit roles and responsibilities

Limitations inherent to the internal auditor’s work

We have undertaken the review of Account Receivable Audit, subject to the limitations outlined below.

Internal control

Internal control systems, no matter how well designed and operated, are affected by inherent limitations. These include the possibility of poor judgment in decision-making, human error, control processes being deliberately circumvented by employees and others, management overriding controls and the occurrence of unforeseeable circumstances.

Specifically, we will not:

• be focusing on controls in place for debt management which has been carried out in 2018/19 audit

Future periods

Our assessment of controls is for the period specified only. Historic evaluation of effectiveness is not relevant to future periods due to the risk that:

• the design of controls may become inadequate because of changes in operating environment, law, regulation or other; or • the degree of compliance with policies and procedures may deteriorate.

Responsibilities of management and internal auditors

It is management’s responsibility to develop and maintain sound systems of risk management, internal control and governance and for the prevention and detection of irregularities and fraud. Internal audit work should not be seen as a substitute for management’s responsibilities for the design and operation of these systems.

We endeavour to plan our work so that we have a reasonable expectation of detecting significant control weaknesses and, if detected, we shall carry out additional work directed towards identification of consequent fraud or other irregularities. However, internal audit procedures alone, even when carried out with due professional care, do not guarantee that fraud will be detected.

Accordingly, our examinations as internal auditors should not be relied upon solely to disclose fraud, defalcations or other irregularities which may exist.